How to run Harbor Registry Behind Haproxy with ca-cert verify required

[TnGadaria]

Hi,
I do have a setup with Harbor Instace-1 and a replication registry, and I am using Haproxy to terminate the certificate, also the backend server (Harbor registry) is using SSL. and this works fine.

Now, I am trying to validate the backend server (Harbor registry) certificate from haproxy using haproxy's ca-cert varify required directive for backed, which gives me a 503 error while accessing the harbor portal.

Can you please help me with this? Let me know if you need additional configuration

For now Harbor configuration looks like this

# Configuration file of Harbor

# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: 192.168.10.144

# http related config
# http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  # port: 80

# https related config
https:
  # https port for harbor, default is 443
  port: 443
  # The path of cert and key files for nginx
  certificate: /data/harbor.crt
  private_key: /data/harbor.key
  # enable strong ssl ciphers (default: false)
  # strong_ssl_ciphers: false`
  
 # Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433

[wy65701436]

I don't understand your question clearly, can you clarify it? when the 502 comes from? Are you trying to access harbor ui through browser?

[TnGadaria]

Hi @wy65701436
Yes, So the 503 error appears from UI as well as CLI via curl when we are trying to access Registry with Haproxy in front with backend server certificate validation.

curl --cacert harbor.CA --cert harbor.crt --key harbor.key https://192.168.10.141:9433 -vv
*   Trying 192.168.10.141:9433...
* Connected to 192.168.10.141 (192.168.10.141) port 9433 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: harbor.CA
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=proxy.lab.com
*  start date: Jul  5 11:02:16 2024 GMT
*  expire date: Mar  7 11:02:46 2025 GMT
*  subjectAltName: host "192.168.10.141" matched cert's IP address!
*  issuer: CN=v3-CA Intermediate Authority
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* Using Stream ID: 1 (easy handle 0x5637f5083d20)
* TLSv1.2 (OUT), TLS header, Unknown (23):
> GET / HTTP/2
> Host: 192.168.10.141:9433
> user-agent: curl/7.76.1
> accept: */*
>
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.2 (IN), TLS header, Unknown (23):
< HTTP/2 503
< content-length: 107
< cache-control: no-cache
< content-type: text/html
<
<html><body><h1>503 Service Unavailable</h1>
No server is available to handle this request.
</body></html>
* Connection #0 to host 192.168.10.141 left intact